Re: [v6ops] Google Alert - IPv6

[Dave O'Reilly <[e-mail]>]

Tom, I have a question.

You say:
 
>> 
> Mark,
> 
> I think the point is that for privacy we _don't_ want IP addresses to
> identify individuals, but it is work to ensure that they don't. The
> fact that a device can be shared makes the coupling weaker, but
> probably not weak enough to be considered good privacy unless the
> population sharing the device is large enough to avoid statistical
> inference.
> 

I never understood this to be a design consideration of IPv4 (I don’t know about IPv6 but perhaps others could enlighten me?). In either case, is it the case that “we don’t want IP addresses to identify individuals”? Is it not more the case that the evolution of technologies on the Internet has, as a side effect, meant that IP addresses don’t identify individuals?



>> There really needs to be something else that supports or proves use of a
>> device other than an assumption that an IP address is tightly coupled to a
>> device's owner, and therefore all actions associated with an IP address are
>> thoe se of the device's owner.
> 
> I believe there is. It is common for apps, like email, social
> networking, etc. to login to a service with username and password.
> When login is done, the service now has a mapping of an individual to
> an IP address. That mapping could then be exploited to identify the
> same individual in completely unrelated communications, hence breaking
> privacy. This could be done external to the device and the network
> provider and across different jurisdictions. The problem is
> exacerbated if the app is always connected so that whenever the
> devices gets a new IP address to user mapping maintained by some third
> party is kept up to date. Also, in this case, randomizing addresses at
> some frequency may no provide much benefit to privacy unless every
> connection gets a different source address (which is effectively is
> what CGNAT gives).
> 

You don’t even need to log in to anything - isn’t this exactly how doubleclick et-al work? They drop a cookie on your browser and then follow you around the Internet on all sites with double-click banners? 

Same problem for any application layer identifying information - but also a bit beyond the scope of the CGNAT discussion...

daveor